Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:30
Behavioral task
behavioral1
Sample
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe
-
Size
339KB
-
MD5
23f48615b9bf1c093d1b316bf6804020
-
SHA1
9c08afd2d257abe65a9bf87bd213cc9480b8ddcd
-
SHA256
940e2ac56b52b74870b773340cfc49479952feda5b2efda9bb66db9f3e4eb6bf
-
SHA512
32e5b4460626324d8e4f2a81645ecef052b9348ffab46e5ce5eb615e0aae52fc8b3ee529eee19285a4554a63990c5e26988891b28eb2674be5b2fb943e98bea7
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiI:9cm4FmowdHoS4BtguSPKyHI
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1016-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-779-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-783-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-939-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-1102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjdd.exe7rfxlfx.exetntntn.exe5bnhnn.exexlxrllr.exethhbhb.exebbthbn.exejppjd.exevvppd.exehbhntb.exe7ddjv.exedvpvj.exenhnhhb.exedjpjv.exenhtntt.exe3jvpp.exebthnnn.exevpvpj.exe7xrlfxr.exelrfrllf.exettbthh.exepvjjd.exebbbtbh.exebtbbhb.exexlxxlxr.exethtttt.exepvjjd.exehtbtnt.exevjvpv.exennbhhb.exe1pjvv.exe7xlllll.exebhbbhn.exedvjjj.exelrllffx.exettnnhh.exetthhbh.exeddjjd.exenhhbbh.exepvjjj.exefrrllff.exe3hnbbn.exeppddj.exelllflfx.exe9tbttb.exejjvpv.exe9jpjj.exerlfffff.exe1tbbbb.exe9jvjj.exe3flllll.exe1nhbbb.exevjjjd.exefffxrrr.exelxxflrr.exepjdvv.exe1xxrlll.exebbtbbh.exehbttbh.exelxlrlrf.exebttttt.exeddjjd.exenbhbtn.exe9jjdp.exepid process 4712 djjdd.exe 2796 7rfxlfx.exe 1572 tntntn.exe 5008 5bnhnn.exe 4868 xlxrllr.exe 2388 thhbhb.exe 3924 bbthbn.exe 4384 jppjd.exe 3444 vvppd.exe 4544 hbhntb.exe 1192 7ddjv.exe 3088 dvpvj.exe 4228 nhnhhb.exe 3100 djpjv.exe 952 nhtntt.exe 2752 3jvpp.exe 1116 bthnnn.exe 1180 vpvpj.exe 1936 7xrlfxr.exe 2000 lrfrllf.exe 3252 ttbthh.exe 1448 pvjjd.exe 3872 bbbtbh.exe 5004 btbbhb.exe 4668 xlxxlxr.exe 1584 thtttt.exe 640 pvjjd.exe 924 htbtnt.exe 3012 vjvpv.exe 2848 nnbhhb.exe 4256 1pjvv.exe 1408 7xlllll.exe 3024 bhbbhn.exe 1772 dvjjj.exe 1792 lrllffx.exe 4360 ttnnhh.exe 2560 tthhbh.exe 4880 ddjjd.exe 3684 nhhbbh.exe 1012 pvjjj.exe 3280 frrllff.exe 3572 3hnbbn.exe 4232 ppddj.exe 4228 lllflfx.exe 2400 9tbttb.exe 1664 jjvpv.exe 2148 9jpjj.exe 2752 rlfffff.exe 1116 1tbbbb.exe 1932 9jvjj.exe 1760 3flllll.exe 1748 1nhbbb.exe 2136 vjjjd.exe 3680 fffxrrr.exe 3648 lxxflrr.exe 3084 pjdvv.exe 1992 1xxrlll.exe 468 bbtbbh.exe 2516 hbttbh.exe 2196 lxlrlrf.exe 4324 bttttt.exe 4316 ddjjd.exe 4712 nbhbtn.exe 3096 9jjdp.exe -
Processes:
resource yara_rule behavioral2/memory/1016-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-4-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djjdd.exe upx behavioral2/memory/4712-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rfxlfx.exe upx behavioral2/memory/2796-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntntn.exe upx behavioral2/memory/1572-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5bnhnn.exe upx C:\xlxrllr.exe upx behavioral2/memory/5008-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4868-33-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thhbhb.exe upx \??\c:\bbthbn.exe upx behavioral2/memory/3924-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2388-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jppjd.exe upx behavioral2/memory/4384-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvppd.exe upx C:\hbhntb.exe upx behavioral2/memory/3444-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4544-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7ddjv.exe upx behavioral2/memory/1192-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpvj.exe upx C:\nhnhhb.exe upx behavioral2/memory/3088-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4228-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djpjv.exe upx behavioral2/memory/4228-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3100-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3100-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/952-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhtntt.exe upx C:\3jvpp.exe upx C:\bthnnn.exe upx behavioral2/memory/1116-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpj.exe upx behavioral2/memory/1180-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xrlfxr.exe upx C:\lrfrllf.exe upx behavioral2/memory/2000-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbthh.exe upx C:\pvjjd.exe upx C:\bbbtbh.exe upx C:\btbbhb.exe upx C:\xlxxlxr.exe upx behavioral2/memory/5004-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thtttt.exe upx behavioral2/memory/4668-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvjjd.exe upx behavioral2/memory/640-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbtnt.exe upx behavioral2/memory/924-165-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvpv.exe upx behavioral2/memory/3012-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbhhb.exe upx behavioral2/memory/2848-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pjvv.exe upx C:\7xlllll.exe upx behavioral2/memory/3024-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1792-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4360-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2560-208-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exedjjdd.exe7rfxlfx.exetntntn.exe5bnhnn.exexlxrllr.exethhbhb.exebbthbn.exejppjd.exevvppd.exehbhntb.exe7ddjv.exedvpvj.exenhnhhb.exedjpjv.exenhtntt.exe3jvpp.exebthnnn.exevpvpj.exe7xrlfxr.exelrfrllf.exettbthh.exedescription pid process target process PID 1016 wrote to memory of 4712 1016 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe djjdd.exe PID 1016 wrote to memory of 4712 1016 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe djjdd.exe PID 1016 wrote to memory of 4712 1016 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe djjdd.exe PID 4712 wrote to memory of 2796 4712 djjdd.exe 7rfxlfx.exe PID 4712 wrote to memory of 2796 4712 djjdd.exe 7rfxlfx.exe PID 4712 wrote to memory of 2796 4712 djjdd.exe 7rfxlfx.exe PID 2796 wrote to memory of 1572 2796 7rfxlfx.exe tntntn.exe PID 2796 wrote to memory of 1572 2796 7rfxlfx.exe tntntn.exe PID 2796 wrote to memory of 1572 2796 7rfxlfx.exe tntntn.exe PID 1572 wrote to memory of 5008 1572 tntntn.exe 5bnhnn.exe PID 1572 wrote to memory of 5008 1572 tntntn.exe 5bnhnn.exe PID 1572 wrote to memory of 5008 1572 tntntn.exe 5bnhnn.exe PID 5008 wrote to memory of 4868 5008 5bnhnn.exe xlxrllr.exe PID 5008 wrote to memory of 4868 5008 5bnhnn.exe xlxrllr.exe PID 5008 wrote to memory of 4868 5008 5bnhnn.exe xlxrllr.exe PID 4868 wrote to memory of 2388 4868 xlxrllr.exe thhbhb.exe PID 4868 wrote to memory of 2388 4868 xlxrllr.exe thhbhb.exe PID 4868 wrote to memory of 2388 4868 xlxrllr.exe thhbhb.exe PID 2388 wrote to memory of 3924 2388 thhbhb.exe bbthbn.exe PID 2388 wrote to memory of 3924 2388 thhbhb.exe bbthbn.exe PID 2388 wrote to memory of 3924 2388 thhbhb.exe bbthbn.exe PID 3924 wrote to memory of 4384 3924 bbthbn.exe jppjd.exe PID 3924 wrote to memory of 4384 3924 bbthbn.exe jppjd.exe PID 3924 wrote to memory of 4384 3924 bbthbn.exe jppjd.exe PID 4384 wrote to memory of 3444 4384 jppjd.exe vvppd.exe PID 4384 wrote to memory of 3444 4384 jppjd.exe vvppd.exe PID 4384 wrote to memory of 3444 4384 jppjd.exe vvppd.exe PID 3444 wrote to memory of 4544 3444 vvppd.exe hbhntb.exe PID 3444 wrote to memory of 4544 3444 vvppd.exe hbhntb.exe PID 3444 wrote to memory of 4544 3444 vvppd.exe hbhntb.exe PID 4544 wrote to memory of 1192 4544 hbhntb.exe 7ddjv.exe PID 4544 wrote to memory of 1192 4544 hbhntb.exe 7ddjv.exe PID 4544 wrote to memory of 1192 4544 hbhntb.exe 7ddjv.exe PID 1192 wrote to memory of 3088 1192 7ddjv.exe dvpvj.exe PID 1192 wrote to memory of 3088 1192 7ddjv.exe dvpvj.exe PID 1192 wrote to memory of 3088 1192 7ddjv.exe dvpvj.exe PID 3088 wrote to memory of 4228 3088 dvpvj.exe nhnhhb.exe PID 3088 wrote to memory of 4228 3088 dvpvj.exe nhnhhb.exe PID 3088 wrote to memory of 4228 3088 dvpvj.exe nhnhhb.exe PID 4228 wrote to memory of 3100 4228 nhnhhb.exe djpjv.exe PID 4228 wrote to memory of 3100 4228 nhnhhb.exe djpjv.exe PID 4228 wrote to memory of 3100 4228 nhnhhb.exe djpjv.exe PID 3100 wrote to memory of 952 3100 djpjv.exe nhtntt.exe PID 3100 wrote to memory of 952 3100 djpjv.exe nhtntt.exe PID 3100 wrote to memory of 952 3100 djpjv.exe nhtntt.exe PID 952 wrote to memory of 2752 952 nhtntt.exe 3jvpp.exe PID 952 wrote to memory of 2752 952 nhtntt.exe 3jvpp.exe PID 952 wrote to memory of 2752 952 nhtntt.exe 3jvpp.exe PID 2752 wrote to memory of 1116 2752 3jvpp.exe bthnnn.exe PID 2752 wrote to memory of 1116 2752 3jvpp.exe bthnnn.exe PID 2752 wrote to memory of 1116 2752 3jvpp.exe bthnnn.exe PID 1116 wrote to memory of 1180 1116 bthnnn.exe vpvpj.exe PID 1116 wrote to memory of 1180 1116 bthnnn.exe vpvpj.exe PID 1116 wrote to memory of 1180 1116 bthnnn.exe vpvpj.exe PID 1180 wrote to memory of 1936 1180 vpvpj.exe 7xrlfxr.exe PID 1180 wrote to memory of 1936 1180 vpvpj.exe 7xrlfxr.exe PID 1180 wrote to memory of 1936 1180 vpvpj.exe 7xrlfxr.exe PID 1936 wrote to memory of 2000 1936 7xrlfxr.exe lrfrllf.exe PID 1936 wrote to memory of 2000 1936 7xrlfxr.exe lrfrllf.exe PID 1936 wrote to memory of 2000 1936 7xrlfxr.exe lrfrllf.exe PID 2000 wrote to memory of 3252 2000 lrfrllf.exe ttbthh.exe PID 2000 wrote to memory of 3252 2000 lrfrllf.exe ttbthh.exe PID 2000 wrote to memory of 3252 2000 lrfrllf.exe ttbthh.exe PID 3252 wrote to memory of 1448 3252 ttbthh.exe pvjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\djjdd.exec:\djjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tntntn.exec:\tntntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\5bnhnn.exec:\5bnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\xlxrllr.exec:\xlxrllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\thhbhb.exec:\thhbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\bbthbn.exec:\bbthbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\jppjd.exec:\jppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\hbhntb.exec:\hbhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\7ddjv.exec:\7ddjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\nhnhhb.exec:\nhnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\djpjv.exec:\djpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\nhtntt.exec:\nhtntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\3jvpp.exec:\3jvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bthnnn.exec:\bthnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\vpvpj.exec:\vpvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\7xrlfxr.exec:\7xrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\lrfrllf.exec:\lrfrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\ttbthh.exec:\ttbthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\pvjjd.exec:\pvjjd.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bbbtbh.exec:\bbbtbh.exe24⤵
- Executes dropped EXE
PID:3872 -
\??\c:\btbbhb.exec:\btbbhb.exe25⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xlxxlxr.exec:\xlxxlxr.exe26⤵
- Executes dropped EXE
PID:4668 -
\??\c:\thtttt.exec:\thtttt.exe27⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pvjjd.exec:\pvjjd.exe28⤵
- Executes dropped EXE
PID:640 -
\??\c:\htbtnt.exec:\htbtnt.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\vjvpv.exec:\vjvpv.exe30⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nnbhhb.exec:\nnbhhb.exe31⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1pjvv.exec:\1pjvv.exe32⤵
- Executes dropped EXE
PID:4256 -
\??\c:\7xlllll.exec:\7xlllll.exe33⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bhbbhn.exec:\bhbbhn.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dvjjj.exec:\dvjjj.exe35⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrllffx.exec:\lrllffx.exe36⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ttnnhh.exec:\ttnnhh.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tthhbh.exec:\tthhbh.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ddjjd.exec:\ddjjd.exe39⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nhhbbh.exec:\nhhbbh.exe40⤵
- Executes dropped EXE
PID:3684 -
\??\c:\pvjjj.exec:\pvjjj.exe41⤵
- Executes dropped EXE
PID:1012 -
\??\c:\frrllff.exec:\frrllff.exe42⤵
- Executes dropped EXE
PID:3280 -
\??\c:\3hnbbn.exec:\3hnbbn.exe43⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ppddj.exec:\ppddj.exe44⤵
- Executes dropped EXE
PID:4232 -
\??\c:\lllflfx.exec:\lllflfx.exe45⤵
- Executes dropped EXE
PID:4228 -
\??\c:\9tbttb.exec:\9tbttb.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjvpv.exec:\jjvpv.exe47⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9jpjj.exec:\9jpjj.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlfffff.exec:\rlfffff.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1tbbbb.exec:\1tbbbb.exe50⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9jvjj.exec:\9jvjj.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3flllll.exec:\3flllll.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1nhbbb.exec:\1nhbbb.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vjjjd.exec:\vjjjd.exe54⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fffxrrr.exec:\fffxrrr.exe55⤵
- Executes dropped EXE
PID:3680 -
\??\c:\lxxflrr.exec:\lxxflrr.exe56⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pjdvv.exec:\pjdvv.exe57⤵
- Executes dropped EXE
PID:3084 -
\??\c:\1xxrlll.exec:\1xxrlll.exe58⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbtbbh.exec:\bbtbbh.exe59⤵
- Executes dropped EXE
PID:468 -
\??\c:\hbttbh.exec:\hbttbh.exe60⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lxlrlrf.exec:\lxlrlrf.exe61⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bttttt.exec:\bttttt.exe62⤵
- Executes dropped EXE
PID:4324 -
\??\c:\ddjjd.exec:\ddjjd.exe63⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nbhbtn.exec:\nbhbtn.exe64⤵
- Executes dropped EXE
PID:4712 -
\??\c:\9jjdp.exec:\9jjdp.exe65⤵
- Executes dropped EXE
PID:3096 -
\??\c:\nnbtnn.exec:\nnbtnn.exe66⤵PID:4308
-
\??\c:\5vpdv.exec:\5vpdv.exe67⤵PID:2608
-
\??\c:\fxxrlll.exec:\fxxrlll.exe68⤵PID:4372
-
\??\c:\hbtnhh.exec:\hbtnhh.exe69⤵PID:4164
-
\??\c:\9rxxfrr.exec:\9rxxfrr.exe70⤵PID:392
-
\??\c:\bbbtnt.exec:\bbbtnt.exe71⤵PID:1332
-
\??\c:\xflfxxr.exec:\xflfxxr.exe72⤵PID:3924
-
\??\c:\tttnhh.exec:\tttnhh.exe73⤵PID:4872
-
\??\c:\djvpj.exec:\djvpj.exe74⤵PID:2296
-
\??\c:\fxllllf.exec:\fxllllf.exe75⤵PID:3564
-
\??\c:\7vdvp.exec:\7vdvp.exe76⤵PID:3496
-
\??\c:\3xxlrxr.exec:\3xxlrxr.exe77⤵PID:5060
-
\??\c:\tnbhtn.exec:\tnbhtn.exe78⤵PID:556
-
\??\c:\pdvpd.exec:\pdvpd.exe79⤵PID:4480
-
\??\c:\fffrlrr.exec:\fffrlrr.exe80⤵PID:2660
-
\??\c:\ttbthb.exec:\ttbthb.exe81⤵PID:2828
-
\??\c:\btbbht.exec:\btbbht.exe82⤵PID:4728
-
\??\c:\5vdjd.exec:\5vdjd.exe83⤵PID:4376
-
\??\c:\rrxfflf.exec:\rrxfflf.exe84⤵PID:4124
-
\??\c:\hbnnnn.exec:\hbnnnn.exe85⤵PID:668
-
\??\c:\vjvjp.exec:\vjvjp.exe86⤵PID:1932
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe87⤵PID:2000
-
\??\c:\hnhntb.exec:\hnhntb.exe88⤵PID:4744
-
\??\c:\dvjvv.exec:\dvjvv.exe89⤵PID:5088
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe90⤵PID:4268
-
\??\c:\bhhhbt.exec:\bhhhbt.exe91⤵PID:3656
-
\??\c:\5hhbnh.exec:\5hhbnh.exe92⤵PID:3872
-
\??\c:\djpdd.exec:\djpdd.exe93⤵PID:3980
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe94⤵PID:1904
-
\??\c:\tbtbnn.exec:\tbtbnn.exe95⤵PID:4708
-
\??\c:\dvddv.exec:\dvddv.exe96⤵PID:988
-
\??\c:\lrfxrxl.exec:\lrfxrxl.exe97⤵PID:932
-
\??\c:\htbtnt.exec:\htbtnt.exe98⤵PID:220
-
\??\c:\dpppp.exec:\dpppp.exe99⤵PID:772
-
\??\c:\rrfllll.exec:\rrfllll.exe100⤵PID:2460
-
\??\c:\ntbnth.exec:\ntbnth.exe101⤵PID:1104
-
\??\c:\hntnhb.exec:\hntnhb.exe102⤵PID:2648
-
\??\c:\jjdvp.exec:\jjdvp.exe103⤵PID:1900
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe104⤵PID:4704
-
\??\c:\bhhbtn.exec:\bhhbtn.exe105⤵PID:1580
-
\??\c:\hbbbbb.exec:\hbbbbb.exe106⤵PID:1332
-
\??\c:\jjddv.exec:\jjddv.exe107⤵PID:4816
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe108⤵PID:3444
-
\??\c:\hthbbb.exec:\hthbbb.exe109⤵PID:4608
-
\??\c:\nnnnnn.exec:\nnnnnn.exe110⤵PID:1012
-
\??\c:\ppddd.exec:\ppddd.exe111⤵PID:3088
-
\??\c:\9ppjv.exec:\9ppjv.exe112⤵PID:3572
-
\??\c:\xxlffxf.exec:\xxlffxf.exe113⤵PID:4232
-
\??\c:\1tbtnn.exec:\1tbtnn.exe114⤵PID:4432
-
\??\c:\ppddp.exec:\ppddp.exe115⤵PID:4228
-
\??\c:\lflxfff.exec:\lflxfff.exe116⤵PID:1664
-
\??\c:\tnttnn.exec:\tnttnn.exe117⤵PID:1780
-
\??\c:\bnnnhb.exec:\bnnnhb.exe118⤵PID:4680
-
\??\c:\pjjjj.exec:\pjjjj.exe119⤵PID:3140
-
\??\c:\7rxrlrr.exec:\7rxrlrr.exe120⤵PID:1168
-
\??\c:\rfxxrlx.exec:\rfxxrlx.exe121⤵PID:4864
-
\??\c:\thnhbh.exec:\thnhbh.exe122⤵PID:3904
-
\??\c:\ddvpp.exec:\ddvpp.exe123⤵PID:2344
-
\??\c:\rflfffx.exec:\rflfffx.exe124⤵PID:4504
-
\??\c:\rxffffl.exec:\rxffffl.exe125⤵PID:2500
-
\??\c:\nbhbbh.exec:\nbhbbh.exe126⤵PID:4268
-
\??\c:\vvpvp.exec:\vvpvp.exe127⤵PID:3492
-
\??\c:\djjvd.exec:\djjvd.exe128⤵PID:4500
-
\??\c:\rxlrlxr.exec:\rxlrlxr.exe129⤵PID:3612
-
\??\c:\nhtbbh.exec:\nhtbbh.exe130⤵PID:1196
-
\??\c:\3thhbt.exec:\3thhbt.exe131⤵PID:640
-
\??\c:\jjppp.exec:\jjppp.exe132⤵PID:1648
-
\??\c:\rllfllf.exec:\rllfllf.exe133⤵PID:3320
-
\??\c:\3bhhbb.exec:\3bhhbb.exe134⤵PID:2848
-
\??\c:\nbhbtt.exec:\nbhbtt.exe135⤵PID:4868
-
\??\c:\ddppp.exec:\ddppp.exe136⤵PID:2460
-
\??\c:\lxxrrff.exec:\lxxrrff.exe137⤵PID:2692
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe138⤵PID:4164
-
\??\c:\btbbtn.exec:\btbbtn.exe139⤵PID:3832
-
\??\c:\dppjd.exec:\dppjd.exe140⤵PID:3200
-
\??\c:\5flfxfr.exec:\5flfxfr.exe141⤵PID:1188
-
\??\c:\1xxxrff.exec:\1xxxrff.exe142⤵PID:4000
-
\??\c:\ntbhbb.exec:\ntbhbb.exe143⤵PID:1192
-
\??\c:\jdvpj.exec:\jdvpj.exe144⤵PID:3104
-
\??\c:\5pppj.exec:\5pppj.exe145⤵PID:3936
-
\??\c:\ffxrfrf.exec:\ffxrfrf.exe146⤵PID:2324
-
\??\c:\3tttnh.exec:\3tttnh.exe147⤵PID:3100
-
\??\c:\9dpjj.exec:\9dpjj.exe148⤵PID:1264
-
\??\c:\9pvvv.exec:\9pvvv.exe149⤵PID:2052
-
\??\c:\rffrrfr.exec:\rffrrfr.exe150⤵PID:3264
-
\??\c:\hhtnbb.exec:\hhtnbb.exe151⤵PID:1592
-
\??\c:\vjdvp.exec:\vjdvp.exe152⤵PID:2668
-
\??\c:\jvpjj.exec:\jvpjj.exe153⤵PID:1180
-
\??\c:\llfrrrr.exec:\llfrrrr.exe154⤵PID:2468
-
\??\c:\nthhhh.exec:\nthhhh.exe155⤵PID:2000
-
\??\c:\pddvj.exec:\pddvj.exe156⤵PID:3092
-
\??\c:\1jpjp.exec:\1jpjp.exe157⤵PID:624
-
\??\c:\rffxxlf.exec:\rffxxlf.exe158⤵PID:2252
-
\??\c:\htttnn.exec:\htttnn.exe159⤵PID:5016
-
\??\c:\ddvjp.exec:\ddvjp.exe160⤵PID:1480
-
\??\c:\jdjdv.exec:\jdjdv.exe161⤵PID:1452
-
\??\c:\fffffll.exec:\fffffll.exe162⤵PID:1584
-
\??\c:\thtttt.exec:\thtttt.exe163⤵PID:4708
-
\??\c:\hbhhhn.exec:\hbhhhn.exe164⤵PID:4324
-
\??\c:\pjpjj.exec:\pjpjj.exe165⤵PID:2440
-
\??\c:\lffxflf.exec:\lffxflf.exe166⤵PID:4768
-
\??\c:\nnhnth.exec:\nnhnth.exe167⤵PID:4560
-
\??\c:\pjjdv.exec:\pjjdv.exe168⤵PID:4388
-
\??\c:\dvpjd.exec:\dvpjd.exe169⤵PID:4692
-
\??\c:\llxrxff.exec:\llxrxff.exe170⤵PID:1596
-
\??\c:\tbnhnn.exec:\tbnhnn.exe171⤵PID:3832
-
\??\c:\7vvpj.exec:\7vvpj.exe172⤵PID:4872
-
\??\c:\pvjjj.exec:\pvjjj.exe173⤵PID:388
-
\??\c:\ffrlllf.exec:\ffrlllf.exe174⤵PID:4732
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe175⤵PID:3280
-
\??\c:\jddjv.exec:\jddjv.exe176⤵PID:3840
-
\??\c:\rrlxfxx.exec:\rrlxfxx.exe177⤵PID:5012
-
\??\c:\3llrlll.exec:\3llrlll.exe178⤵PID:2400
-
\??\c:\bbnbhb.exec:\bbnbhb.exe179⤵PID:2996
-
\??\c:\ddppp.exec:\ddppp.exe180⤵PID:1664
-
\??\c:\9rxxrxx.exec:\9rxxrxx.exe181⤵PID:4728
-
\??\c:\llrxlrx.exec:\llrxlrx.exe182⤵PID:2752
-
\??\c:\bbhttt.exec:\bbhttt.exe183⤵PID:3780
-
\??\c:\pvvvv.exec:\pvvvv.exe184⤵PID:3060
-
\??\c:\1xfrxxr.exec:\1xfrxxr.exe185⤵PID:1936
-
\??\c:\bbnbbt.exec:\bbnbbt.exe186⤵PID:3252
-
\??\c:\jvpjj.exec:\jvpjj.exe187⤵PID:4520
-
\??\c:\dpvpp.exec:\dpvpp.exe188⤵PID:4504
-
\??\c:\fffrlxr.exec:\fffrlxr.exe189⤵PID:1132
-
\??\c:\ttbbtt.exec:\ttbbtt.exe190⤵PID:3380
-
\??\c:\vpjjp.exec:\vpjjp.exe191⤵PID:4508
-
\??\c:\1jpjd.exec:\1jpjd.exe192⤵PID:3872
-
\??\c:\xxllfff.exec:\xxllfff.exe193⤵PID:4620
-
\??\c:\nhtnhh.exec:\nhtnhh.exe194⤵PID:5080
-
\??\c:\ddppj.exec:\ddppj.exe195⤵PID:3692
-
\??\c:\rrxfxrr.exec:\rrxfxrr.exe196⤵PID:920
-
\??\c:\bnnnhb.exec:\bnnnhb.exe197⤵PID:1648
-
\??\c:\jvjpv.exec:\jvjpv.exe198⤵PID:3040
-
\??\c:\lffxrrl.exec:\lffxrrl.exe199⤵PID:3096
-
\??\c:\hnbbbn.exec:\hnbbbn.exe200⤵PID:4964
-
\??\c:\djpjj.exec:\djpjj.exe201⤵PID:4372
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe202⤵PID:4164
-
\??\c:\9nhhbh.exec:\9nhhbh.exe203⤵PID:3924
-
\??\c:\jddjj.exec:\jddjj.exe204⤵PID:4532
-
\??\c:\frxrrrr.exec:\frxrrrr.exe205⤵PID:1188
-
\??\c:\llxxffx.exec:\llxxffx.exe206⤵PID:3444
-
\??\c:\tttnbb.exec:\tttnbb.exe207⤵PID:756
-
\??\c:\tththn.exec:\tththn.exe208⤵PID:3496
-
\??\c:\ddjvp.exec:\ddjvp.exe209⤵PID:2228
-
\??\c:\fxffxxr.exec:\fxffxxr.exe210⤵PID:412
-
\??\c:\nhnnnn.exec:\nhnnnn.exe211⤵PID:4416
-
\??\c:\bhttbn.exec:\bhttbn.exe212⤵PID:2148
-
\??\c:\pdpvp.exec:\pdpvp.exe213⤵PID:716
-
\??\c:\rxfllrx.exec:\rxfllrx.exe214⤵PID:4376
-
\??\c:\rlfffll.exec:\rlfffll.exe215⤵PID:4600
-
\??\c:\dppjd.exec:\dppjd.exe216⤵PID:1592
-
\??\c:\vdvjj.exec:\vdvjj.exe217⤵PID:4956
-
\??\c:\rrlflff.exec:\rrlflff.exe218⤵PID:1760
-
\??\c:\hbnhnn.exec:\hbnhnn.exe219⤵PID:2100
-
\??\c:\pjpjd.exec:\pjpjd.exe220⤵PID:1112
-
\??\c:\rllffxr.exec:\rllffxr.exe221⤵PID:5088
-
\??\c:\ffrffxx.exec:\ffrffxx.exe222⤵PID:4592
-
\??\c:\3nbbtb.exec:\3nbbtb.exe223⤵PID:1580
-
\??\c:\djpjd.exec:\djpjd.exe224⤵PID:3084
-
\??\c:\rxllffx.exec:\rxllffx.exe225⤵PID:3980
-
\??\c:\nbbtnn.exec:\nbbtnn.exe226⤵PID:4620
-
\??\c:\nbnhhb.exec:\nbnhhb.exe227⤵PID:3008
-
\??\c:\pjpjj.exec:\pjpjj.exe228⤵PID:3692
-
\??\c:\llffxfx.exec:\llffxfx.exe229⤵PID:4324
-
\??\c:\hthhhh.exec:\hthhhh.exe230⤵PID:3068
-
\??\c:\vdpjj.exec:\vdpjj.exe231⤵PID:4868
-
\??\c:\1dvpj.exec:\1dvpj.exe232⤵PID:4388
-
\??\c:\rxxxrxl.exec:\rxxxrxl.exe233⤵PID:2076
-
\??\c:\btnnhh.exec:\btnnhh.exe234⤵PID:2120
-
\??\c:\vpjjp.exec:\vpjjp.exe235⤵PID:1332
-
\??\c:\1dddj.exec:\1dddj.exe236⤵PID:1032
-
\??\c:\lrxrxrx.exec:\lrxrxrx.exe237⤵PID:4544
-
\??\c:\bttnhh.exec:\bttnhh.exe238⤵PID:2232
-
\??\c:\nbbtnn.exec:\nbbtnn.exe239⤵PID:5060
-
\??\c:\jpvdj.exec:\jpvdj.exe240⤵PID:3840
-
\??\c:\xxxlffx.exec:\xxxlffx.exe241⤵PID:4948
-
\??\c:\nbbtnn.exec:\nbbtnn.exe242⤵PID:952